"Mise en Place" for CISO Operations

Myke Lyons is the CISO of Cribl, the AI platform for telemetry — a fitting seat for someone who got his start in telemetry more than two dozen years ago, back when the choice was "put it in the SIEM or throw it out the window." Before security, he was a professional chef, including time at Bistro Don Giovanni in Napa working for Donna and Giovanni Scala, and he's since built field-facing trust programs at ServiceNow and now Cribl that treat security as a revenue function, not a cost center. This conversation is about the part of security operations most programs get wrong before a single detection fires: the economics of data, and the discipline of being prepared.

The anchor numbers are blunt. Data is growing at roughly a 28% CAGR — measured before agentic AI started multiplying tool calls, audit logs, and chain-of-thought output on top of everything else. Egress, not storage, is the biggest line item on most data bills. And every LLM query in your detection pipeline has a token cost that scales into real money, while an ML detection costs CPU cycles. Myke walks through how he tiers data, why his relationship with his CFO is the most valuable one he has, how Cribl's acquisition of CardinalOps fits a month-over-month, rule-by-rule detection discipline, and why "mise en place" is the phrase his team hears constantly. The back half covers breach stigma, the Tim Brown outcome, and what it takes to run a field-facing security program with integrity. If you own a SIEM bill, a detection backlog, or a budget conversation with finance, this one is aimed at you.

RISC Point is security & compliance consulting tailored to your business. Talk to RISC Point.

Hampton North is the premier US based cybersecurity search firm. Start building your security team with Hampton North.

Sysdig is the leader in AI-powered real-time cloud defense; stop watching and start defending.

Myke started in telemetry when the decision was binary: index it in the SIEM or delete it. His argument now is that modern pipelines give you tiers, and the exercise of sorting data into them is itself worth doing. Top of the pyramid: the discrete, high-fidelity events you want to correlate and action, sent to the most expensive destination. Second tier: context — the data that feeds threat hunting and investigations when an alert fires. Third tier: compulsory data you'll never action but a regulator will ask for.

The freezer metaphor is doing real work. When a regulator wants to know what Stu was doing in a system six years ago, a query that takes days to return is fine — you're paying for retention, not speed. Below that sits dev null, and the honest admission that some data should never be kept at all.

Myke also flags that SIEMs and data lakes are converging — "those things are getting closer together because data's expensive" — and that the growth curve driving all of this predates the current wave of agents. The last figure he'd seen was roughly a 28% CAGR on data growth, measured before generative and agentic AI use cases took hold. As he puts it, agents aren't creating less data. They're creating more, and different kinds: tool calls, reasoning traces, audit logs for every action a bot takes.

Conor opens the episode with the observation that one of the most important forcing functions in any security program comes from the office of the CFO, and Myke doesn't push back — he goes further. At Cribl, unit economics is such a fixture of the CFO's presentations that the phrase gets a knowing chuckle from any employee. Myke treats that as an asset, not an obstacle.

The CISO is a major contributor, but the CFO is the one sitting in the audit committee having the enterprise risk management conversation, with the CEO standing beside them. That framing changes how you build. Risk tolerance varies wildly by industry — finance at the bottom, ad tech near the top, cyber and technology companies somewhere low — and the CEO sets the strategy. Your job, as Stuart puts it, is to make the most appropriate recommendation; if leadership wants 10x growth at 2x risk, that can still be a rational call, even if it doesn't feel great from the CISO seat.

The economics thread runs into a second argument Myke clearly cares about: ownership.

His first several SIEMs locked down access to his own data, which meant moving it to another system to do anything useful with it — which meant paying again. Storage is relatively cheap; processing and movement are increasingly expensive, and egress is where the biggest bills live. Conor tells a story about building a threat intel platform where the number one cost was egress between cloud providers, and the conversation turns to a live worry: SaaS security vendors who believe your data will make them money later, and may start rate-limiting access to it behind new SKUs. Once it's in their walled garden, is it still your data? Myke's position is that you should be able to put your data wherever you want, in whatever structure, in one place or ten.

Asked how a CISO should approach detection and response for agents — both the authorized ones inside the enterprise that might go rogue and the adversarial ones, like the end-to-end agentic ransomware campaign Sysdig's research team documented as Jade Puffer — Myke starts with the unfashionable answer: the old methodologies still apply. MITRE ATT&CK mapped back to your detections is a continuous internal conversation at Cribl. But the sharper point is about discipline.

False positives create alert fatigue, fatigue creates a numb team, and a numb team is a cultural problem, not a tooling problem. He tells a story about a founder who turned on every rule in a new product "just to see what was firing" — the exact opposite of what he wants.

Cribl has been running that exercise since the beginning of the year — a manual, month-over-month, rule-by-rule journey — and recently acquired CardinalOps, which is built for exactly that problem. The data doesn't need to be perfect OCSF, but if you're detecting on username and the username field isn't there, the detection can't work — and an LLM agent will happily hallucinate one for you.

On LLMs in the pipeline, Myke is deliberately conservative: Cribl's security team isn't ready to use full LLMs in detections, and he still sees more value in hard-and-fast rules, with LLM triage as a later layer. Conor frames the same hierarchy in cost terms: ML detections cost CPU cycles, LLM reasoning costs tokens, and even a dollar a query becomes real money at scale. Reasoning belongs on problems that are complicated and worth being expensive. Myke's version is shorter:

If your foundation is a data swamp, pointing an agent at it and hoping is not a detection strategy. Or, as he sums up the whole data-foundations problem: "being lazy is initially really cheap. It just becomes very expensive in the long term."

Myke was a chef before he was a security leader, and the crossover is more than crisis tolerance — though there's plenty of that. Kitchens run on chaos: late food, wrong orders, a chef who showed up dusty and forgot the special. Security people, he argues, thrive in exactly that environment, especially in investigations, juggling blinky lights of varying confidence and asking whether this is a person, a campaign, or just another victim scenario.

The durable lesson he took from kitchens is mise en place — everything measured, chopped, sharpened, and staged before you execute a dish. His mapping to security is direct: standard operating procedures, playbooks, detections in place, logs being collected, endpoint agents deployed. Readiness before service.

Conor extends it into threat scenarios: if a threat actor does A, B, C, and D, do you have the capabilities and the data to detect, respond, and contain across that lifecycle? It sounds fundamental, and it is — which is exactly why it gets lost when the team is firefighting audits and customer requests. Myke's version: do you know what the attacks look like? There are your IOCs. Do you know how they'll attack you? There are your TTPs.

The kitchen years also supplied the episode's best story. Sent out with scissors and a bucket to cut rosemary at Bistro Don Giovanni in Napa, New Jersey-raised Myke searched the herb garden and came up empty — because in Napa, rosemary isn't a spiky two-foot plant.

The line got him laughed off the line, and Stuart draws the parallel: expertise is credibility, in a kitchen or a boardroom. Miss the ingredients — or walk into an executive conversation not knowing what your team is working on — and, in Myke's words, "you'd get smoked."

Conor raises the industry's habit of getting persnickety about leaders who go through a breach, when everyone privately knows it's a numbers game. Myke's take: the stigma is smaller than it looks, mostly internal to the community — "how did you let that happen?" — and the antidote is transparency. He points to the recent Hugging Face incident as a model of it, and contrasts the people inside cyber, who increasingly defend each other, with the people outside it: attorneys chasing headlines, and juries that are not panels of technologists.

Stuart adds the recruiting reality, which is more counterintuitive than the stigma narrative suggests:

Five or ten years ago that wasn't true. It is now, because an incident is an inevitability, and what's actually being evaluated is the handling. The uglier side also gets named: vendors who use breaches as FUD-driven sales platforms — "don't be Target" — a message Stuart argues comes from executives, not sales teams, who make convenient punching bags.

The SolarWinds case anchors the discussion. Myke credits the executive team, CISO included, with supporting each other and their customers through a horrible scenario — flawed along the way, maybe, but directionally right. Conor describes the call after the case against Tim Brown was dropped, with 150 leaders spending a minute congratulating him on being out of "this hellish circumstance" — and the counterpoint lands too: 150 isn't a lot, and plenty of people who've never sat in a high-profile seat were loudly judgmental on Reddit and LinkedIn throughout. The Mel Robbins prescription gets quoted: let them.

Myke is one of a small number of security leaders who've built trust programs with measurable revenue impact — at ServiceNow and now at Cribl — so Conor closes by asking what that looks like done well. The answer starts with integrity, in the CIA-triad sense and the human one: before you walk into a room with a customer or prospect, know whether what you're selling will functionally make them better. Myke describes walking out of sales conversations and telling his own team that even if the prospect says yes, they probably won't be successful — and saying so.

Put enough good situations into the world and good comes back; call it karma or call it arithmetic. The second principle is empathy for sellers — people who are competitive, resilient, and in the room for the right reasons, and who Field CISOs in particular should treat as colleagues rather than a distribution channel. The third is pattern recognition: take what you hear across dozens of customer interactions, zoom out, see the forest, and hand people a map through it.

Underneath all of it is the recognition that security is part of the business, full stop. Myke closes with a line he credits to lifelong friend and fellow CISO Justin Dolly, and claims under his father's rule of quotation — cite it once, then it's yours forever:

Trust built in the good times is what holds when the fire starts.

Guests — Myke Lyons, CISO at Cribl, the AI platform for telemetry. Started in telemetry more than two dozen years ago; previously built field-facing trust programs including at ServiceNow; former professional chef, including at Bistro Don Giovanni in Napa under Donna and Giovanni Scala.

Books mentioned — None named in the conversation.

Frameworks / models / tools named — MITRE ATT&CK; OCSF; SIEM (and SIEM/SEM); CardinalOps (acquired by Cribl); Cribl; AWS; LLM-based triage; ML detections; Sysdig's Jade Puffer research (first documented end-to-end agentic ransomware extortion campaign); mise en place; the CIA triad; data tiering.

Other people / shows / resources referenced — Tim Brown and the SolarWinds incident; the Target breach; the Hugging Face incident; Justin Dolly; Mel Robbins ("Let them"); Robert Mondavi; Francis Ford Coppola; Sofia Coppola; The Godfather; Donna and Giovanni Scala; Bistro Don Giovanni.